Critical severity9.8NVD Advisory· Published Jul 28, 2023· Updated Jun 17, 2026

CVE-2023-39020

Description

stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
edu.stanford.nlp:stanford-parserMaven	< 4.5.5	4.5.5

Affected products

stanford-parser/stanford-parserdescription
ghsa-coords
pkg:maven/edu.stanford.nlp/stanford-parser
Range: < 4.5.5

Patches

Vulnerability mechanics

References

github.com/LetianYuan/My-CVE-Public-References/tree/main/edu_stanford_nlp_stanford-parsernvdExploitWEB
github.com/advisories/GHSA-353m-jh2m-72v4ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-39020ghsaADVISORY
github.com/stanfordnlp/CoreNLP/commit/897231bed0efb24574c80c875c0b5f2225c145bcghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000